As countermeasures against these gradient inversion attacks, prior work proposed both principled defenses based on differential privacy [1]}, as well as heuristics that compress the gradient update through gradient pruning [2]} or sign compression [3]}. In particular, gradient compression defenses have so far enjoyed great success, severely hindering the effectiveness of existing optimization-based attacks [4]}, [5]} while maintaining close to the same level of accuracy for the trained model.
As a result, these limitations seemingly diminish the threat of gradient inversion in practical FL applications.
<FIGURE>